Data Breach Notification Laws by State: Deadlines, Triggers and Attorney General Reporting

Most jurisdictions still use a flexible standard, but that is not a free pass. A regulator can look at a slow response and decide the delay was unreasonable.

Read the start of each clock carefully. Some states count from discovery, others from the point you determine a breach happened or is likely to cause harm.

Fourteen jurisdictions want a regulator told about every breach that requires notice, so a small incident in the wrong state still means a filing.

Regulator deadlines can be shorter than the consumer one. Iowa counts 5 business days after consumer notice, and Louisiana 10 days after resident notice.

The exemptions matter as much as the rules. Many states treat a bank that follows federal GLBA rules, or a HIPAA-covered health provider, as already compliant.

Recent changes to state breach notification laws

Source: Perkins Coie, 2025 breach notification law update; Privacy Rights Clearinghouse, Data Breach Notification Laws: 50 States + DC Survey, 2026 Edition; State of Delaware, Delaware Code Online, Delaware Code Title 6, Chapter 12B Computer Security Breaches; McDonald Hopkins, Delaware raises the bar: Significant amendments to its Personal Data Privacy Act; New York State Senate, New York Senate Bill S2659-B (2023-2024), bill actions. Download as image

Shortest deadlines: states with 30-day individual notice

Source: California Legislature (text via California.Public.Law), Cal. Civ. Code § 1798.82; Colorado Attorney General, Data Protection Laws (Colorado breach notification FAQ); The Florida Legislature, Fla. Stat. § 501.171 Security of confidential personal information; Maine Legislature, Office of the Revisor of Statutes, 10 M.R.S. § 1348 Security breach notification; New York State Senate, N.Y. General Business Law § 899-aa; Washington State Legislature, RCW 19.255.010 Disclosure, notice. Download as image

Deadline to notify affected individuals by state

• 630 days
• 1145 days
• 560 days
• 29No fixed number of days

How long do you have to report a data breach?

The honest answer is: it depends on the state of each affected person. California, Colorado, Florida, Maine, New York and Washington are the fastest, at 30 days. Eleven states, including Maryland, Ohio and Arizona, allow 45 days. Connecticut, Delaware, Louisiana, South Dakota and Texas allow 60.

Everywhere else, the statute says something like "most expedient time possible, without unreasonable delay." That sounds relaxed. In practice, if a breach list includes even one New Yorker, you are working to New York's 30 days for that person. It is usually simpler to send every notice on the shortest timeline that applies.

Notice the starting gun, too. California's 30 calendar days run from discovery or notification of the breach. Texas runs 60 days from determining the breach occurred. Alabama counts 45 days from determining the breach is reasonably likely to cause substantial harm. Two companies with the same incident can face different dates depending on how quickly they confirm what happened.

When do you have to tell the Attorney General?

36 states require a report to the Attorney General or another state agency. The trigger is usually a headcount. Texas wants a report within 30 days once 250 or more Texans are affected. Colorado uses 500 or more residents and Washington more than 500, both with 30 days. Florida's Department of Legal Affairs wants notice within 30 days when 500 or more people in Florida are affected. Alabama and Arizona switch on at more than 1,000 individuals notified.

Some states skip the headcount and want every reportable breach. Massachusetts requires notice to the Attorney General and its consumer affairs office for all breaches. New Jersey goes further and wants the Division of State Police told before customers are. Maryland requires the Attorney General to be told first, before individuals get their 45-day notice.

So the order of steps matters. A business that emails customers first and then calls the New Jersey State Police has already broken the sequence.

Which states changed their breach laws recently?

Several states tightened the rules in the last two years, and the trend is toward hard numbers. New York added a firm 30-day deadline. California moved to 30 calendar days for consumers and a sample notice to the Attorney General within 15 calendar days of notifying consumers, when more than 500 residents are involved. Oklahoma now requires Attorney General notice within 60 days of resident notice for 500 or more residents, effective January 1, 2026. Delaware added Attorney General notice within 60 days when affected residents cannot be identified.

If your incident response plan was written a few years ago and says "notify without unreasonable delay," it is out of date for some of the biggest states. Check the recent changes table on this page and update the plan before you need it.

What kind of data triggers a breach notice?

Every state law starts with a definition of personal information, and that definition decides whether you have a reportable breach at all. The classic version is a first name or initial plus a last name, combined with a Social Security number, a driver's license number, or a financial account number with the code needed to use it. A leaked email list on its own often falls outside that definition.

The definitions keep getting wider, though. 24 jurisdictions explicitly cover medical information, 24 cover all government ID numbers and 22 explicitly cover biometric data such as fingerprints or face scans. Many also include a username or email address paired with a password. If your business collects any of that, a breach is more likely to count.

Two details trip people up. First, encryption usually helps: most states exempt encrypted data, though many drop that exemption if the key was also taken. Second, many states let you skip notice after a documented decision that the breach is unlikely to cause harm, but some, like Alaska, want that decision sent to the Attorney General in writing. Keep notes either way. If a regulator asks later why you did not notify, you want a dated record of what you checked and why.

What this means for a small business, freelancer or employee

For a small business, the legal duty usually sits with whoever owns or licenses the data. If you keep a customer list in a SaaS tool and that vendor is breached, the vendor must tell you, but you are often the one who has to notify customers and regulators. Your deadline can start running the day the vendor tells you. A vendor that sits on the news for weeks leaves your customers exposed and leaves you explaining the delay.

For a freelancer who handles client data, such as a bookkeeper or a developer with production access, a breach on your laptop can put your client on the clock. Expect clients to ask for prompt notice in your contract, and expect them to try to push the notification costs onto you.

For employees, your own HR file counts. Payroll and benefits systems hold exactly the data these laws protect. In 24 jurisdictions you may also have a private right of action, meaning you can sue the business directly rather than waiting for the state to act. Only 6 require free credit monitoring, so do not assume you will get it.

What should you do before a breach happens?

• Make a short list of the states where your customers, employees and contractors live. That list sets your real deadline.
• Write the shortest deadline that applies at the top of your response plan. For many businesses that will be 30 days.
• Note which states need a regulator told first, such as New Jersey and Maryland, and which use a headcount trigger.
• Ask every vendor that stores personal data how fast it will tell you about a breach, in hours, and get that number into the contract.
• Check who pays for notice letters, call centers and credit monitoring if the breach happens on the vendor's side.
• Review your cyber insurance for notification costs and whether it requires you to use the insurer's chosen lawyers.

Sources and method

Every number on this page comes from the sources below, each opened and read on or before October 18, 2026. A second, independent review checked every figure against its source and corrected anything that did not match. 51 of 51 state entries were confirmed; any that could not be are marked "Not yet confirmed" and left out of every count and chart.

1. Privacy Rights Clearinghouse, Data Breach Notification Laws: 50 States + DC Survey, 2026 Edition (2026 Edition (laws enacted as of January 1, 2026))
2. California Legislature (text via California.Public.Law), Cal. Civ. Code § 1798.82 (Current text as amended by SB 446 (2025))
3. New York State Senate, N.Y. General Business Law § 899-aa (Most recent revision 2025-03-28)
4. Washington State Legislature, RCW 19.255.010 Disclosure, notice (Current (2019 c 241, effective March 1, 2020))
5. The Florida Legislature, Fla. Stat. § 501.171 Security of confidential personal information (2026 Florida Statutes)
6. Maine Legislature, Office of the Revisor of Statutes, 10 M.R.S. § 1348 Security breach notification (Current (PL 2019, c. 512))
7. Maryland General Assembly, Md. Code, Commercial Law § 14-3504 (Current statute text)
8. State of Delaware, Delaware Code Online, Delaware Code Title 6, Chapter 12B Computer Security Breaches (Current, including 85 Del. Laws c. 464 (2026))
9. McDonald Hopkins, Delaware raises the bar: Significant amendments to its Personal Data Privacy Act (September 11, 2026)
10. Colorado Attorney General, Data Protection Laws (Colorado breach notification FAQ) (Accessed 2026-10-18)
11. Office of the Texas Attorney General, Data Breach Reporting (Accessed 2026-10-18)
12. California Department of Justice, Office of the Attorney General, Data Security Breach Reporting (Accessed 2026-10-18)
13. Perkins Coie, 2025 breach notification law update (October 15, 2025)
14. Legal Information Institute, Cornell Law School (Louisiana Administrative Code), La. Admin. Code tit. 16, pt. III, § 701 (Notice to the Attorney General of database security breach) (Current rule text, accessed 2026-10-18)
15. New York State Senate, New York Senate Bill S2659-B (2023-2024), bill actions (Signed chap.647, December 21, 2024)